c6a1437c67946e2b4050826bf03690b020fbb74d18e474f09c3d9a3d2037bd2a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ET Series Setup 1.0/setup.exe
Size 666KB
Sample260420-plc8msh13m
SHA256 c6a1437c67946e2b4050826bf03690b020fbb74d18e474f09c3d9a3d2037bd2a
MD5 1ef3560ded47c3f1d9e64c14ecd659ea
SHA1 d233e200540c8c34ab72db7fb83e29ed76540b66
SHA512 50776330f7381f893f242c06dfa85c6292c11be1301db9859f1f8037e4f3976195277588b9bbed27a9461e40a49c0c09dc024fb704b6f7bd3bc406e50893a1ab
SSDEEP 6144:TXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qjaUojDuUlOR1H:zYYuUx65QwDMq6TOUZeDuUlOTH
TLSH
T179E4642556E8A139F3F79A70BFF45023AA65BC622A34CC9F11D5134D0A62E52ED6033F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
692	ET Series Setup.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dfsvc.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dfsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	dfsvc.exe
File created	C:\Windows\assembly\Desktop.ini	dfsvc.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\lock!010000003316580eac040000300800000000000000000000 = 30303030303461632c30316463643063316637303738306434	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\identity = 4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_cbf04e0bb39cded6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\lock!090000004c17580eb4020000300c000000000000000000000805a = 30303030303262342c30316463643063316663386434356538	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\lock!060000009016580eac040000300800000000000000000000 = 30303030303461632c30316463643063316637303738306434	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\lock!020000002d17580eb4020000300c00000000000000000000 = 30303030303262342c30316463643063316663386434356538	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\SizeOfStronglyNamedComponent = d034000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\lock!040000009016580eac040000300800000000000000000000 = 30303030303461632c30316463643063316637303738306434	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08 = 660069006c0065003a002f002f002f0043003a002f00550073006500720073002f00410064006d0069006e002f0041007000700044006100740061002f004c006f00630061006c002f00540065006d0070002f00450054002500320030005300650072006900650073002500320030005300650074007500700025003200300031002e0030002f0045005400250032003000530065007200690065007300250032003000530065007400750070002e006100700070006c00690063006100740069006f006e000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\identity = 4554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_etse..tion_7a526ddad350dea5	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_etse..tion_309f33586a0b08ee_533d4962e2aa5d5f\LastRunVersion = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2f4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08 = 660069006c0065003a002f002f002f0043003a002f00550073006500720073002f00410064006d0069006e002f0041007000700044006100740061002f004c006f00630061006c002f00540065006d0070002f00450054002500320030005300650072006900650073002500320030005300650074007500700025003200300031002e0030002f0045005400250032003000530065007200690065007300250032003000530065007400750070002e006100700070006c00690063006100740069006f006e0023004500540020005300650072006900650073002000530065007400750070002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d0031002e0030002e0030002e0034002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0033003000390066003300330035003800360061003000620030003800650065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f004500540020005300650072006900650073002000530065007400750070002e006500780065002c002000560065007200730069006f006e003d0031002e0030002e0030002e0034002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0033003000390066003300330035003800360061003000620030003800650065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\lock!080000003c17580eb4020000300c00000000000000000000 = 30303030303262342c30316463643063316663386434356538	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31	ET Series Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "6DGTQ7ETWOQ08VXOPABOGB8C"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\etse..etup_none_0001.0000_none_c2579ddebd59a5ff\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\identity = 4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\etse..etup_none_0001.0000_none_c2579ddebd59a5ff\ident = 4554205365726965732053657475702c2056657273696f6e3d312e302e302e302c2043756c747572653d6e65757472616c2c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_etse..tion_309f33586a0b08ee_ed9afec6ade69d39\LastRunVersion = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2f4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\lock!070000009016580eac040000300800000000000000000000276a8 = 30303030303461632c30316463643063316637303738306434	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "GD7W98LWMY96J4A2LXRAQ9G6"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\SizeOfPrivateComponentsInDeployment = ab75010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\appid = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2f4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\lock!040000002d17580eb4020000300c00000000000000000000 = 30303030303262342c30316463643063316663386434356538	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08 = 4554205365726965732053657475702e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "0"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_etse..tion_309f33586a0b08ee_ed9afec6ade69d39	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\implication!etse..tion_309f33586a0b08ee_0001.0000_cbf = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\identity = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2f4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 1196	4440	setup.exe	79
PID 1196 wrote to memory of 692	1196	dfsvc.exe	80

C:\Users\Admin\AppData\Local\Temp\ET Series Setup 1.0\setup.exe
"C:\Users\Admin\AppData\Local\Temp\ET Series Setup 1.0\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Local\Apps\2.0\6DGTQ7ET.WOQ\08VXOPAB.OGB\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\ET Series Setup.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\6DGTQ7ET.WOQ\08VXOPAB.OGB\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\ET Series Setup.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ET Series Setup.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\6DGTQ7ET.WOQ\08VXOPAB.OGB\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\ET Series Setup.exe
Size 89KB
SHA256 1a340f33e0f5fee36feb347862e38217cc8d262ec28c8c25e69d1c073a6872d2
MD5 52d736bd1be7ad27e5091c81f826e5a5
SHA1 21817ca676f529f8fa9e0d35b9ec3e27a4cf19e6
SHA512 83d9e3670e7416a7f4bd0432d7081ccb91760aa8d1c97e0c3e83deace73570aa785ac7cda5f4deb7c45013562fbe5cbd201727a866c81733a7677c981a2d1909
SSDEEP 768:ag3JVfUqROc78CbA/+feqVMZLJDxB9LandoAyN0da4r5Yidxsu/zDr/E:ag5FDFACbA/+feq69woAFaC5pdx5zDg
TLSH
T11793973036AAA119D93957B00D79E2C153767A7EBF14CB6E2895024CEE637134B01FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6DGTQ7ET.WOQ\08VXOPAB.OGB\manifests\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed.cdf-ms
Size 10KB
SHA256 f2cd8b11e98e1cb691f1b7afc0c73d6e03a85586a2133d855c4ed7c95fae3f65
MD5 4a7390c258a88d2dcb6b3dfe02a3c703
SHA1 64f7ebe666b86a8e419540405d7391830597ca61
SHA512 3ad991c54b0c4f802310758e2ab19d60ea2600e0a12788aef830bc2547486328cf547b6f37a61e23ec091426a9a1291827e352abfdee3791941a769988ccd543
SSDEEP 96:t1hmnvQEEW0/8RRnUWJtSyn5kmcJsI+ngH7ypS0iYyFjGPwpdi7JsErFf3v8LPbE:t1hmvB3LxymcGAr9Dd6JsKxv8LjjqZ
TLSH
T1B1320700BAA0C957D2515733ECE6C3E07272BDD24E47178B744ABB1FBE317D5A8022A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6DGTQ7ET.WOQ\08VXOPAB.OGB\manifests\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204.cdf-ms
Size 8KB
SHA256 647ea1197247027200a64d5a94c76bc9ffa4eaf3a32e56e4aff2dd52670d2f3a
MD5 c9eb4e781cb3e7809ecb2fa9257a7fc1
SHA1 2c2ebe0d794f139c204bf9cf809ec7c6c22a58bc
SHA512 df302f3e8781c2add50a5924e1e2de40a0e152c7462d14608148fd78fb4e7a7300bf9e05d86d8eba05b6452e57d47543a379a857aab6519eeecbedc541aea50d
SSDEEP 96:I2FytEW05R5onUm7cTtkVSYL+nguDy1jQ0iYyFjImS+8xAZ6pskbe:I7VH97jVSLr9M5e
TLSH
T153F12A41BAA1C803D2056333ACE2C7E27372BDD24E57934B74467F0FBD707989A42666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35GC6A6D.BEE.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8645W964.E9Q\35GC6A6D.BEE.application
Size 5KB
SHA256 83ba06273ad0992942d90f8df0575bc14e67515d0318b3256bf402988d9002ff
MD5 68ad161a71e27ccf2f560b206a611177
SHA1 e060bf752055a4341af3dbd2af55ce42f47eb9de
SHA512 3dcb5fc050279b4a98f1af418d59abbcbb37bc77f9ca2dec9dd0354b14f34bea87a4c755c67df6f18290683fa56dccf8020b13a482c1a59cbdc10c832bd964d1
SSDEEP 96:xWtZq1jeaboH5SkMmSYZkmOMVa+bEQj+kQ0iYyFj5BDA:o95tSmZ0br9bA
TLSH
T1C0B1A559C8C9D802F305E6707AF2D5032A9927B340FC84C8BDB55C9EEF546E981023BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ET Series Setup.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PTXQNCDQ.08K\GHT8H97W.A3W\ET Series Setup.exe.manifest
Size 7KB
SHA256 531c70f7aab8dd9079472769688ddd1f01785633dc7ce8d30ce76b9f44df5d00
MD5 2129e3917c7dc8dab171661c91ee1d34
SHA1 ac6527773ebc7eb5810f5ed1316d44d9f16e7cc2
SHA512 2b4c9eb39349037b339a543ccec2d22c9181f85ebe82059d27ab6145de6b17863373dcf8620c5b6371703341f6f4bbfcd393245e9ab0256fe4f714ca8575e3ff
SSDEEP 96:xWt41jhwOL/1tYcAe3Syj2NknndJHkmOz8A++bEoYkQ0iYyFj5BDA:oM7rYcAehdnd1ORtYbr9bA
TLSH
T1A4E1C65AC4C8E811A32296903EF3D613AB5A23A344ED18C9FD6D994FEF186D581433B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-117-0x000000001D4D0000-0x000000001D5EE000-memory.dmp

Download

memory/692-116-0x000000001CE10000-0x000000001CFC3000-memory.dmp

Download

memory/692-115-0x000000001B9D0000-0x000000001B9DC000-memory.dmp

Download

memory/692-108-0x0000000000E10000-0x0000000000E18000-memory.dmp

Download

memory/692-104-0x000000001B930000-0x000000001B9CC000-memory.dmp

Download

memory/692-103-0x000000001BEE0000-0x000000001C3AE000-memory.dmp

Download

memory/1196-22-0x000001E2A42E0000-0x000001E2A42F0000-memory.dmp

Download

memory/1196-20-0x000001E2A42E0000-0x000001E2A42F0000-memory.dmp

Download

memory/1196-29-0x00007FFCB8830000-0x00007FFCB91D1000-memory.dmp

Download

memory/1196-30-0x000001E2C01C0000-0x000001E2C0268000-memory.dmp

Download

memory/1196-34-0x000001E2A6FA0000-0x000001E2A6FBC000-memory.dmp

Download

memory/1196-27-0x000001E2C0490000-0x000001E2C0752000-memory.dmp

Download

memory/1196-26-0x000001E2A6F70000-0x000001E2A6F78000-memory.dmp

Download

memory/1196-23-0x00007FFCB8830000-0x00007FFCB91D1000-memory.dmp

Download

memory/1196-0-0x000001E289970000-0x000001E289978000-memory.dmp

Download

memory/1196-43-0x00007FFCB8830000-0x00007FFCB91D1000-memory.dmp

Download

memory/1196-21-0x00007FFCB8AE5000-0x00007FFCB8AE6000-memory.dmp

Download

memory/1196-28-0x000001E2C0300000-0x000001E2C0436000-memory.dmp

Download

memory/1196-19-0x000001E2A42E0000-0x000001E2A42F0000-memory.dmp

Download

memory/1196-105-0x000001E289D80000-0x000001E289D8C000-memory.dmp

Download

memory/1196-107-0x000001E2A4200000-0x000001E2A4212000-memory.dmp

Download

memory/1196-106-0x000001E2A42F0000-0x000001E2A440E000-memory.dmp

Download

memory/1196-11-0x000001E2A42E0000-0x000001E2A42F0000-memory.dmp

Download

memory/1196-109-0x000001E2A42E0000-0x000001E2A42F0000-memory.dmp

Download

memory/1196-110-0x00007FFCB8AE5000-0x00007FFCB8AE6000-memory.dmp

Download

memory/1196-111-0x00007FFCB8830000-0x00007FFCB91D1000-memory.dmp

Download

memory/1196-6-0x000001E2A4240000-0x000001E2A4290000-memory.dmp

Download

memory/1196-2-0x000001E2A42E0000-0x000001E2A42F0000-memory.dmp

Download

memory/1196-1-0x000001E2A3F70000-0x000001E2A40F8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads